GO-2024-3107 vulnerabilities

Vulnerabilities for packages: cue, render-template, kyverno-policy-reporter-ui, thanos, cilium-cli, prometheus-pushgateway, gh, kubernetes-ingress-defaultbackend, trino, buildah, azcopy, dataplaneapi, fuse-overlayfs-snapshotter, timestamp-authority, vt-cli, crane, esbuild, kserve-rest-proxy,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: kubevela, pulumi-kubernetes-operator, crossplane-provider-azure-storage, falcoctl, slsa-verifier, flux-kustomize-controller, rook, k3d, ksops, gomplate, sops, step-ca, nuclei, flux-image-automation-controller, scorecard, zarf, crossplane-provider-family-azure, gh,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: cue, render-template, kyverno-policy-reporter-ui, thanos, cilium-cli, prometheus-pushgateway, gh, kubernetes-ingress-defaultbackend, dataplaneapi, fuse-overlayfs-snapshotter, timestamp-authority, vt-cli, temporal-server, crane, esbuild,...

Security Updates for Azure CycleCloud < 8.9.2 (August 2026)

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-70340 - Missing authorization in Azure CycleCloud allows...

Security Updates for Azure CycleCloud < 8.9.1

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-57969 - An improper input...

USN-8529-2 linux-azure, linux-gcp, linux-hwe, linux-oracle vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-64192 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp...

GHSA-3HVR-PHFH-X26G vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp...

USN-8635-1 linux-azure vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

CVE-2026-73298

The CVE-2026-73298 entry concerns the Microsoft Container Migration Solution Accelerator (multi-service AI-driven migration tool) with vulnerability in version 2.1.2 and earlier. The issue is an authenticated IDOR (Insecure Direct Object Reference) that permits reading, writing, and deleting proc...

CVE-2026-66378

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

Vulnerabilities in Microsoft Azure

Microsoft has identified vulnerabilities in various Azure components. Malicious actors could exploit these vulnerabilities to carry out attacks that can lead to the types of damages listed in the table below. The vulnerability with the identifier CVE-2026-56162, which has a CVSS score of 10.0, an...

CVE-2026-71331

Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

CVE-2026-70340

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

CVE-2026-66802

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

CVE-2026-65806

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...

CVE-2026-63522

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

CVE-2026-62869

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network...

CVE-2026-57104

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-57104

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...